CVE-2024-3094
CVE-2024-3094 · Xz: malicious code in distributed source
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
CVSS 10.0 · Critical · EPSS 90.9% · Public exploit · Fix available
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
No fix published
red hat enterprise linux 6
No fix published
red hat enterprise linux 7
No fix published
red hat enterprise linux 8
No fix published
red hat enterprise linux 9
No fix published
red hat jboss enterprise application platform 8
No fix published
xz-utils Debian:13
- Affected ranges
- ECOSYSTEM: < 5.6.1+really5.4.5-1
Update to 5.6.1+really5.4.5-1
xz-utils Debian:14
- Affected ranges
- ECOSYSTEM: < 5.6.1+really5.4.5-1
Update to 5.6.1+really5.4.5-1
Original sources
- https://access.redhat.com/security/cve/CVE-2024-3094
- https://bugzilla.redhat.com/show_bug.cgi?id=2272210
- https://www.openwall.com/lists/oss-security/2024/03/29/4
- https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
- https://www.binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images
- https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/
- https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/
- https://aws.amazon.com/security/security-bulletins/AWS-2024-002/
- https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz
- https://boehs.org/node/everything-i-know-about-the-xz-backdoor
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024
- https://bugs.gentoo.org/928134
- https://bugzilla.suse.com/show_bug.cgi?id=1222124
- https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405
- https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27
- https://github.com/advisories/GHSA-rxwq-x6h5-x525
- https://github.com/amlweems/xzbot
- https://github.com/karcherm/xz-malware
- https://gynvael.coldwind.pl/?lang=en&id=782
- https://lists.debian.org/debian-security-announce/2024/msg00057.html
- https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html
- https://lwn.net/Articles/967180/
- https://news.ycombinator.com/item?id=39865810
- https://nvd.nist.gov/vuln/detail/CVE-2024-3094